Storing secrets for third-party services

[zeke]

Migrated from https://github.com/probot/ideas/issues/69

I've seen mention of probots that write tweets, and I know @bkeepers is thinking about a GitHub App that would publish to npm. How does probot collect and store credentials like API keys and Twitter passwords? Is there an emerging pattern for solving this problem?

[gr2m]

ping @benschwarz

[patcon]

Trello Power-Ups don't actually allow privileged credential storage, just shared and private "visibility", but perhaps worth knowing about: https://developers.trello.com/reference/#get-set-custom-data

Trello Developers

[bkeepers]

I would love if a GitHub App could:

• store metadata attached to any GitHub resource (issue, pull request, repo, user, org, etc)
• choose the visibility (@patcon suggests)
• optionally encrypt the data with their public key
• Have a simple query interface against custom data (e.g. give me all issues where reminder:<2017-04-20)

[stale[bot]]

Is this still causing friction? If so, please comment with any updates or addition details.

[gr2m]

oh boy it does this cause friction 😽

[zeke]

💡 What about storing encrypted values in .github/config.yml that only a probot installation can decrypt?

Like Travis Encryption keys.

[JasonEtco]

What about storing encrypted values in .github/config.yml that only a probot installation can decrypt?

Adding the encrypted key to the file would be the tough part - you'd need some kind of UI to input the unencrypted key, then maybe the app could open a PR adding it?

[gr2m]

sounds like something I’d love to have built-in into Probot or an extension

[benschwarz]

@zeke, @JasonEtco - Encrypted values in .github/config.yml sounds like a good first step.

Although if the app had to request permissions for opening PRs to add it (but otherwise that app didn't need those permissions, it'd look a bit fishy to users).

[benschwarz]

Forgot to say, this is definitely something that causes friction. I could see a lot more applications successfully using probot if there were a github-side encryption service or something of that nature.

[bkeepers]

Here's an experiment with using the private key to encrypt secrets: https://gist.github.com/bkeepers/c52ab6854cd549457561e75dbad93744 (use at your own risk)

Gist

An experiment using a RSA private key to encrypt/decrypt secrets.

An experiment using a RSA private key to encrypt/decrypt secrets.

[dessant]

It seems the initial setup could be done by redirecting during installation, but how would the config key be updated by users after that?

[stale[bot]]

Is this still causing friction? If so, please comment with any updates or addition details.

[zeke]

Hi @stale. Yeah this issue is still relevant.

[stale[bot]]

Is this still causing friction? If so, please comment with any updates or addition details.

[gr2m]

a lot.

[gr2m]

I wonder why it got staled when the issue has a "pinned" label and stale is configured to ignore issues that have it? https://github.com/probot/.github/blob/da58fd987250c4d97307d740c632221d3d5b37db/.github/stale.yml#L8-L10

GitHub

probot/.github

Org-wide settings. Contribute to probot/.github development by creating an account on GitHub.

[stale[bot]]

Is this still causing friction? If so, please comment with any updates or addition details.

[gr2m]

It’s supported for actions, but major friction for apps

[2rojan]

For myself, I'm running my Probot out of a kube cluster, so I stored all of my secret bits in a kubernetes secret - but only because there wasn't any better way to do it. Would be kinda cool to see this move forward.

[gr2m]

I still hope that secrets will be made available to apps similar to how they are made available to actions :) Maybe in a similar way as the single file access, where you have to define explicitly which secrets the app gets access to. We will update this issue if there are any news on that

[stale[bot]]

Is this still causing friction? If so, please comment with any updates or addition details.

[stale[bot]]

Is this still causing friction? If so, please comment with any updates or addition details.

[drgs]

Is there any update regarding this issue?

[zeke]

GitHub Secrets are still only available in GitHub Actions, but not to GitHub Apps.

cc @jovel